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DETAILED ACTION 

1 . Claims 1-24 are pending for examination. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 
that form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in 
public use or on sale In this country, more than one year prior to the date of application for patent in the 
United States. 

3. Claims 8-1 1 and 1 5-1 8 are rejected under 35 U.S.C. 1 02(b) as being 
anticipated by hyperDRIVE: Leveraging LDAP to Implement RBAC on the Web" by 
BARTZ. 

4. BARTZ was cited in the previous office action. 

5. As to claim 8, BARTZ teaches a method for accessing contents of a resource 
(invoking a business service) by a user (client), comprising: 

accessing a resource which requires registration by a user (via the business 
data services verify that the user is authorized to run the service by communicating 
with the LDAP server to get the user's authentication information) (see fig. 2; pg. 72 
first and second column); 

when the resource supports universal registration and the user is universally 
registered, obtaining registration information from a registration dynamic object 
(LDAP server / directory server) (via the business data services verify that the user 
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is authorized to run the service by communicating with the LDAP server to get the 
user's authentication information) (see fig. 2; pg. 72 first and second column); and 

allowing the user to access contents of the resource (via through the 
hyperDRIVE Guide applet, the customer invol<es an operation such that the web 
server uses its ORB to contact the LDAP server to determine whether the 
customer's authenticated identified (distinguished name) matches the one provided 
to allow the user to use the resource) (see fig. 2; pg. 72 first and second column). 

6. As to claim 9, BARTZ teaches when the resource fails to support universal 
registration and the user utilizes a registration dynamic base object, registering the 
user by the registration dynamic base object per pre-registered user data (via the 
user sends its distinguished name to the business service such that it verifies the 
user has access by comparing it to the one stored on the LDAP server wherein the 
act of authorization and authentication are separate activities, thus they occur at 
different times, SEE PG. 70, 4th - 6th paragraphs). The cited teachings of BARTZ, 
inherently teach allowing the registration to occur after the requesting access and 
dynamically change how the resources are protected (pg. 70, second column, 
behaviorial summary). 

7. As to claim 10, BARTZ teaches when the resource supports universal 
registration and the user is not universally registered, entering registration 
information by the user (via the web client authenticating with the web server / LDAP 
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server in order access various business services) (see fig. 2; pg. 72 first and second 
column). 

8. As to claim 1 1 , BARTZ teaches the registration information includes a name 
(via the web client authenticating with the web server / LDAP server in order access 
various business services) (see fig. 2; pg. 72 first and second column). It is inherent 
that in order to authenticate with a server, the client has to send its. 

9. As to claims 15-18, reference is made to a computer readable medium that 
corresponds to the method of claims 8-1 1 and is therefore met by the rejection of 
claims 8-1 1 above. 

Claim Rejections - 35 USC § 103 

1 0. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the phor art are such that the subject matter as a whole would have been obvious at 
the time the invention was made to a person having ordinary skill in the art to which said subject 
matter pertains. Patentability shall not be negatived by the manner in which the invention was 
made. 

1 1 . Claims 1-7 and 12-14 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over hyperDRIVE: Leveraging LDAP to Implement RBAC on the Web" 
by BARTZ. 

1 2. BARZT was cited in the previous office action. 
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1 3. As to claim 1 , BARTZ teaches the invention substantially as claim including a 
method for providing universal registration, comprising: 

providing user registration information of a user to a universal registration 
resource (via the web client authenticating with the web server / LDAP server in 
order access various business services) (see fig. 2; pg. 72 first and second column), 
the user registration information (distinguished name / user authentication 
information) accessible by providers of resources (via the business data services 
verify that the user is authorized to run the service by communicating with the LDAP 
server to get the user's authentication information) (see fig. 2; pg. 72 first and 
second column); and 

requesting use of a provider resource which requires the user registration 
information, wherein the provider resource automatically retrieves the user 
registration information from the universal registration resource to enable the user to 
access the provider resource (via through the hyperDRIVE Guide applet, the 
customer invokes an operation such that the web server uses its ORB to contact the 
LDAP server to determine whether the customer's authenticated identified 
(distinguished name) matches the one provided to allow the user to use the 
resource) (see fig. 2; pg. 72 first and second column). 

14. However, BARTZ does not teach that the network is an information appliance 
network. Official Notice is taken in that such a network is well known in the art, and 
since BARTZ teaches that the invention is implemented in Java for its "write once, 
run anywhere" quality it would be obvious to one of ordinary skill in the art that the 
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invention is applicable to an information appliance network since the code can run 
anywhere. 

15. As to claims 2-6, BARTZ teaches the user registration information is 
contained in a program object (via the role objects / DN (object describing people) 
being stored in the LDAP server which is a directory (see pg 70, Behavioral 
Summary and pg. 72 first and second columns). The cited reference does not detail 
that the name or object is in a string naming convention, however, Official Notice is 
taken in that object names, distinguished names are in a string naming convention 
that details the location of the object, the object name, and a method of the object 
and therefore it would be obvious that the distinguished names or other 
authentication information provided is in this format to be compared with the 
business services retrieved authentication information for the user to see if the user 
is permitted to access the service. 

16. As to claim 7, BARTZ teaches the registration information includes a name 
(via the web client authenticating with the web server / LDAP server in order access 
various business services) (see fig. 2; pg. 72 first and second column). It is inherent 
that in order to authenticate with a server, the client has to send its name. 

17. As to claims 12 and 13, BARTZ teaches the invention substantially as claim 
including a system for universal registration comprising: 
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a digital information server for sending a registration interface dynamic base 
object (authenticated distinguished name reference to the LDAP directory object) 
(see fig. 2; pg. 72 first and second columns; in particular item 1); 

a universal register (LDAP server) for hosting a registration implementation 
dynamic base object (role objects), the registration implementation dynamic base 
object corresponding to the registration interface dynamic base object (see fig. 2; pg. 
72 first and second column, in particular item 9); 

a resource (server), communicatively coupled to the digital information server 
and the universal register via a network, requiring user registration (via through the 
hyperDRIVE Guide applet, the customer invokes an operation such that the web 
server uses its ORB to contact the LDAP server to determine whether the 
customer's authenticated identified (distinguished name) matches the one provided 
to allow the user to use the resource) (see fig. 2; pg. 72 first and second column); 
and wherein using the registration implementation dynamic base object (role 
objects) to provide user registration information, a user of the digital information 
server gains access to contents of the resource (via through the hyperDRIVE Guide 
applet, the customer invokes an operation such that the web server uses its ORB to 
contact the LDAP server to determine whether the customer's authenticated 
identified (distinguished name) matches the one provided to allow the user to use 
the resource) (see fig. 2; pg. 72 first and second column). 

18. However, BARTZ does not teach that the network is an information appliance 
network. Official Notice is taken in that such a network is well known in the art, and 
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since BARTZ teaches that the invention is implemented in Java for its "write once, 
run anywhere" quality it would be obvious to one of ordinary skill in the art that the 
invention is applicable to an information appliance network since the code can run 
anywhere. 

19. As to claim 14, BARTZ teaches the registration information includes a name 
(via the web client authenticating with the web server / LDAP server in order access 
various business services) (see fig. 2; pg. 72 first and second column). It is inherent 
that in order to authenticate with a server, the client has to send its name. 

20. Claims 1 9-24 are rejected under 35 U.S.C. 1 03(a) as being unpatentable over 
hyperDRIVE: Leveraging LDAP to Implement RBAC on the Web" by BARZT, and in 
view of DANCS et al. (hereafter DANCS) (U.S. Patent No. 6385651). 

21 . BARZT was cited in the previous office action. 

22. As per claim 19, BARZT teaches the invention substantially as claimed in 
claim 1 . BARZT did not specifically teach that said requesting further comprises 
determining that the provider resource does not have said user registration 
information. 

23. However, DANCS teaches determining that the provider resource does not 
have said user registration information (col. 11, lines 14-45). 
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24. It would have been obvious to one of an ordinary skill in the art at the time the 
invention was made to have combined the teaching of BARZT and DANCS because 
DANCs teaching of determining that the provider resource does not have said user 
registration information would improve the integrity of by providing a security 
paradigm for effectively managing appliance interaction in a distributed computing 
environment. 

25. As per claim 20, DANCS teaches that wherein the requesting use of the 
provider resource is a first time request for the use of the provider resource (col. 1 1 , 
line 40 through col. 12, line 28). 

26. As per claims 21 -24, they are rejected for the same reason as claims 1 9-20 
above. 

Response to Arguments 

27. Applicant's arguments filed 01/22/2008 with respect to claims 1-18 have been 
fully considered but they are not persuasive. 

28. In the remark, applicant argued with respect to claims 1 , and 1 5 that (1 ) 
BARZT fails to teach a user may enter registration information into the universal 
registration resource when utilizing a digital information appliance the first time or 
later when desiring to utilize charged content resources; (2) BARZT does not use 
that registration information authorize subsequent access; (3) BARZT fails to teach 
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wherein said provider resource automatically retrieves said user registration 

information from said universal registration resource to enable said user to access 
said provider resource (4) when said resource supports universal registration and 
said user is universally registered, obtaining registration information from a 
registration dynamic object. 

29. Examiner respectful disagreed with applicant. 

As to point (1), applicant argued that BARZT fails to teach a user may enter 
registration information into the universal registration resource when utilizing a digital 
information appliance the first time or later when desiring to utilize charged content 
resources. However this limitation ii not claimed in claims 1, and 15. 

As to point (2), claims 1 , and 15 never stated or cited specifically that the 
registration information authorize subsequent access as argued by applicant. 

As to point (3), applicant argued that BARZT fails to teach wherein said 
provider resource automatically retrieves said user registration information from said 
universal registration resource to enable said user to access said provider resource 
by pointing out that the registration information of BARZT is pre-registered 
information and not dynamic register information as claimed in claims 1,15. 
Examiner disagreed with applicant because according to the claimed language of 
claims 1, and 15, the registration information could be both pre-register information 
or dynamically register information. In this case, BARZT is pre-register information. 
Thus, BARZT still meet the language of claims 1,15. Therefore, BARZT clearly 
teaches wherein said provider resource automatically retrieves said user registration 
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information from said universal registration resource to enable said user to access 
said provider resource (via through the hyperDRIVE Guide applet, the customer 
invokes an operation such that the web server uses its ORB to contact the LDAP 
server to determine whether the customer's authenticated identified (distinguished 
name) matches the one provided to allow the user to use the resource) (see fig. 2; 
pg. 72 first and second column). 

As to point (4), BARZT clearly teaches (LDAP server / directory server) (via 
the business data services verify that the user is authorized to run the service by 
communicating with the LDAP server to get the user's authentication information) 
(see fig. 2; pg. 72 first and second column). 

Conclusion 

30. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure (see attached PTO 892 form for details). 

31 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory action 
is mailed, and any extension fee pursuant to 37 CFR 1 .136(a) will be calculated from 
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the mailing date of the advisory action. In no event, however, will the statutory 
period for reply expire later than SIX MONTHS from the mailing date of this final 
action. 

32. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to JENNIFER N. TO whose telephone number is 
(571 )272-721 2. The examiner can normally be reached on M-T 6AM- 3:30 PM, F 
6AM- 2:30 PM. 

33. If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Meng-Ai An can be reached on (571) 272-3756. The fax 
phone number for the organization where this application or proceeding is assigned 
is 571-273-8300. 

34. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR 
only. For more information about the PAIR system, see http://pair-direct.uspto.gov. 
Should you have questions on access to the Private PAIR system, contact the 
Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like 
assistance from a USPTO Customer Service Representative or access to the 
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automated information system, call 800-786-9199 (IN USA OR CANADA) or 571- 
272-1000. 

/Meng-AI An/ 

Supervisory Patent Examiner, Art Unit 2195 



